Update Alert

put

https://api.doppel.com/v2/alert

Updates an alert's information in Doppel's system. Works across all modules.
The organization is determined from the org_id claim in the JWT.

You must provide exactly one of id or entity to identify the alert. At least one field to update must be provided in the request body.

Paired parameters:

tag_action and tag_name must both be provided together.
file_action and files must both be provided together.

Set assignee to the email of a customer-visible organization member. Set it to JSON null to unassign the alert. Unknown, internal, hidden, deactivated, or out-of-organization emails return 404.
An update that changes only brand or assignee does not change queue_state. A comment in an assignee update also does not change queue_state.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

string

The alert ID (format ORG-1234). Mutually exclusive with entity.

entity

string

The URL, phone number, or email of the alert to update. Mutually exclusive with id.

audit_log_limit

integer

0 to 200

Defaults to 100

Maximum number of recent audit log entries to return.

Body Params

Fields to update on the alert. At least one field is required.
tag_action/tag_name and file_action/files are paired — both in each pair must be provided together.

queue_state

string

enum

New queue state to update the alert with.
(Note: taken_down is equivalent to Resolved in the Doppel Vision App)

Allowed:

entity_state

string

enum

The live status of the entity (URL, phone number, etc.) that the alert is tracking.

active: The entity is currently live/accessible.
down: The entity is no longer accessible (e.g. domain taken down).
parked: The domain is parked (registered but not hosting active content).
suspicious: The entity appears to be malicious or suspicious.
unclassified: The entity has not yet been classified.
unrelated: The entity has been determined to be unrelated to the brand.
related: The entity is related to the brand but not necessarily malicious.
unknown: The entity's status cannot be determined.

brand_id

uuid

The brand ID to associate with the alert, replacing the current one. The brand must be active and belong to your organization. Cannot be cleared once set.

assignee

string | null

Email of a customer-visible organization member, or null to unassign.

comment

string

A new comment to add to the alert.

tag_action

string

enum

Action to take on a tag for an alert.

add: Associate the named tag with the alert.
remove: Remove the named tag from the alert.

Allowed:

tag_name

string

Name of the tag to add or remove. Must be provided together with tag_action.

file_action

string

enum

Type of file operation to perform on an alert.

upload: Upload new files (file_to_upload is required for each file).
delete: Delete existing files (only file_name is required).

Allowed:

files

array of objects

length ≤ 10

Supporting attachments shown under Uploaded Files. Must be provided together with file_action. Maximum 10 files per request. When file_action is "upload", each file must include base64-encoded content in file_to_upload. When file_action is "delete", only file_name is required. These files are independent of screenshot.

files

screenshot

object

The primary alert screenshot. This image is independent of supporting attachments in files. An update replaces the current screenshot and does not run classification again.

Responses

200Updated alert successfully

400Invalid input

401Unauthorized - invalid or missing JWT

403Forbidden - org_id not mapped to a Doppel organization

404Alert, assignee, brand, or tag not found

429Rate limit exceeded

500Internal Server Error